Extract specific value/pattern from log file

[Agoyals]

Hi ,

I am new to Dynatrace and looking to explore logs. Looking for help to extract specific value from logs.

Query
fetch logs
| filter dt.host_group.id == "XXXX" AND log.file.path == "XXXXX"

Example log content

[2025-06-11T05:15:35.487-0400][1596955825ms] GC(175) Pause Young (Normal) (G1 Evacuation Pause) 334M->40M(512M) 5.847ms

[2025-06-11T05:15:35.492-0400][1596955830ms] GC(175) Pause Young (Normal) (G1 Evacuation Pause) 362M->55M(512M) 4.827ms

[2025-06-11T04:14:04.275-0400][473664263ms] GC(58) Pause Young (Normal) (G1 Evacuation Pause)

Looking to extract the ms value at the end of event. I tried to use parse command but not working.

[jmarbaix]

Hi Agoyals,

You can do something like this:

fetch logs
| filter dt.host_group.id == "XXXX" AND log.file.path == "XXXXX"
| parse content, """
DATA 
'(512M)' // Literal string just before the ms value
SPACE // Space character before the desired value
(DIGIT '.' DIGIT):value // The value column will contain the desired number, if it's always in the form X.XXX
'ms' // To end the parsing

If you want to plot the values, or handle them as a number, you can use the following command:
| fieldsAdd value = toDouble(value)

Hope this helps.

[g_kat · Accepted solution]

Hi,

Adding to @jmarbaix's answer, you could also use this parse in case you don't have that 512M as static:

parse content, "LD'->' LD SPACE (DIGIT'.'DIGIT):value 'ms'"

Note: if you convert it to double it will round the value to 2 decimal points. In which case, you can straight up transfomr it to double by doing: DOUBLE:value in the parse.

[jmarbaix]

Good one!